Cryptographic systems are widely used to ensure the privacy and authenticity of messages transmitted over public communication channels, such as telephone lines. One type of cryptographic system, generally known as a privacy cryptosystem, prevents extraction of information by unauthorized parties from messages transmitted over such an insecure communication channel, thus assuring a sender that a message being sent is read only by an intended receiver. Another type of cryptographic system, generally known as an authentication cryptosystem, prevents undetected alteration or unauthorized injection of messages into the insecure communication channel, assuring an intended receiver of the authenticity of an intended message. Cryptographic systems are heavily relied on in military, diplomatic and business communications of information, including voice, picture and text data.
A conventional type of privacy cryptosystem allows a sender to transmit a plaintext message P over, for instance, a telephone line to a receiver. At the sender's site, an encryption device encodes with a secret key the plaintext message P into a ciphertext message C, which is then transmitted. At the receiver's site, a decryption device decodes the ciphertext message C with the secret key back into the plaintext message P. The secret key is one known only to the two conversers. Given this secret key, the transformations on the message can be performed, without the secret key the transformations cannot, even with the most powerful computers known to mankind. Thus for an enemy eavesdropper, who wants to decipher the message and yet is assumed to have no information about the secret key, it is infeasible to determine the plaintext message P corresponding to a given ciphertext, or to determine the secret key even if he were given matching plaintext/ciphertext pairs. But one problem with this system is that it requires the distribution of secret keys to the communicating parties. This is often done over a secure channel such as priority mail, or in advance by a trusted courier, which can be expensive, or impossible, as in many military applications.
U.S. Pat. No. 4,200,770, issued to Diffe and Hellman, teaches a well-known public key distribution system, allowing two parties to agree on a secret key even if they do not share any secret initially and even if an enemy eavesdropper can listen to their entire communication over the insecure communication channel. In order to do so, both parties independently and randomly select a secret key which they store in their system secretly. Each party then transforms their secret key into a corresponding public key so it is infeasible for an enemy to reverse the transformation process to find out their respective secret keys. The public keys are then exchanged over the insecure communication channel. (Alternatively, a public directory service provides a listing of all the previously registered public keys, again accessed over a channel that is assumed to be insecure.) In order to generate a mutual secure cipher key each converser performs a transformation involving its own secret key and the other party's public key. At the sender's site, the encryption device encodes with the mutual secure cipher key a plaintext message P into a ciphertext message C, which is then transmitted. At the receiver's site, the decryption device decodes the ciphertext message C with the mutual secure cipher key back into the plaintext message P. Unlike the previous system described, the public key is readily available to all users of the communication channel. The system has the important property that even though the enemy eavesdropper knows a user's public key on the communication channel, it is infeasible to generate the user's secret key. Moreover, even if the enemy eavesdropper knows the sender's public key and the receiver's public key, it is still infeasible to generate the mutual secure cipher key. See also Diffie and Hellman, New Directions In Cryptography, IEEE Trans. on Inform. Theory, volume IT-22, November 1976.
However, a disadvantage of the Diffe-Hellman system is that the enemy eavesdropper may impersonate a given user by claiming that the enemy eavesdropper's public key is the user's public key. Thus the public keys of any given user must be capable of being verified or authenticated by a communicating party. This is known in the art as the authenticity problem. As one way of identifying public keys, a trusted authority digitally signs user public keys, so that after exchanging the public keys, the communicating parties can check the signature and verify the authenticity of the communicating parties public key. See Rivest, Shamir and Adleman, A Method For Obtaining Digital Signatures And Public-key Cryptosystems, Communications of the ACM, volume 21 (1978). This system although solving the authenticity problem, still suffers from the disadvantage of being interactive, i.e. users must exchange public information before being able to generate the mutual secure cipher key. A major disadvantage of a user interactive communication system is that many important applications do not allow for an interactive protocol (e.g., electronic mail, many military and diplomatic applications). Another disadvantage of an interactive system is that they are much less efficient, and much more expensive because of the required interaction.
In another system known as an identity-based signature system, the need to authenticate a user's public key does not arise because the public key consists entirely of publicly known information, encoded as such with a user's name, address, physical description, etc. See Shamir, Identity-Based Cryptosystems And Signature Schemes, CRYPTO '84, Lecture Notes in Computer Science, Volume 196, New York, N.Y.: Springer Verlag (1985). This publicly known information does not need to be authenticated and is referred to as the user's identity. However this system is a digital signature system that cannot be used as a privacy cryptosystem.
Moreover, the idea of using identity-based information as part of the public key in a public key distribution system has been proposed. See Tsujii and Itoh, An ID-based Cryptosystem Based On The Discrete Logarithm Problem, IEEE J. on Selected Areas in Communications, volume 7, no. 4, May (1989); Gunther, An Identity-based Key-exchange Protocol, presented at Eurocrypt'89, Houthalen, Belgium, (1989); Koyama and Ohta, Identity-based Conference Key Distribution Systems, Proceedings CRYPTO'87, Lecture Notes in Computer Science, volume 293, New York, N.Y.: Springer Verlag (1988); and Okamoto and Tanaka, Key Distribution Based On Identification Information, IEEE J. on Selected Areas in Communications, volume 7, May (1989). In these systems, a trusted authority is used to issue users' secret keys. This solves the problem of verifying the authenticity of a certain user's public key. These systems are known in the art as identity-based public key distribution system. But a disadvantage of these approaches is that they require user interaction for the exchange of the public key. Some other disadvantages are as follows: Some of the methods require too much computation for being truly practical and are not sufficiently efficient for most applications. See Koyama and Ohta, Identity-based Conference Key Distribution Systems, Proceedings CRYPTO'87, Lecture Notes in Comp. Science, volume 293, Springer Verlag (1988) and Tsujii and Itoh, An ID-based Cryptosystem Based On The Discrete Logarithm Problem, IEEE J. on Selected Areas in Communications, volume 7, no. 4, May 1989. The Koyama and Ohta approach has been demonstrated to be insecure. The Tsujii and Itoh approach offers the potential for non-interactive user communication but requires a very large amount of computation and is insecure when too many users collaborate in order to determine other users' secret keys.